Verify C2PA

Select a file from your device or drag it into the verifier. The C2PA signature check runs alongside Content Credentials parsing, integrity verification and trust-chain validation. The summary shows the result and declared provenance data. The original file is not changed: verification concerns the signed content, not whether what it describes or depicts is true.

You can select images such as JPEG, PNG and WebP, PDF documents, video, audio and .c2pa manifests, up to 250 MB per file. Whether credentials can be read depends on the file format and content. PDFs display an icon, name and size without a page preview. The absence of a preview does not by itself indicate a problem with the credentials.

No. The selected file is processed in your browser and is not uploaded to our servers. The verifier may make network requests to download trust lists and retrieve external manifests referenced by the file, so it is not a fully offline tool. Reading credentials and downloading the JSON do not modify the original file.

A valid credential has passed integrity and signature checks. It is trusted when the signer's certificate can also be traced to the trust lists used by the verifier. An invalid credential has failed one or more checks; the details help explain which ones. None of these results alone certifies that the information or depicted scene is true.

It means the signature may be valid, but the certificate cannot be traced to the C2PA trust lists being used. This does not automatically mean the file is fake or altered. “Trust list unavailable” means the lists required for this check could not be retrieved, which is different from an unrecognized signer.

No. It only means the verifier did not find readable C2PA credentials in that file. The content may never have been signed, or its credentials may have been removed during export, conversion or sharing. The absence of credentials proves neither that the content is fake nor that it is authentic.

It is not a universal detector for AI-generated images. Credentials may include declarations about the tools used, modifications and the content's digital origin. Verification checks those credentials, but the absence of an AI declaration does not prove an image is a real photograph. An AI-generated image can also have valid credentials.

The manifest.json file exports the complete ManifestStore returned by the C2PA library: available manifests, assertions, ingredients, signature information and check results, when present. It is also available for invalid credentials so their warnings can be analyzed. Binary resources such as thumbnails may be represented by references. It does not replace the signed document and does not necessarily match the c2patool --detailed report.